From 55f8126c6eb85b2800eaf91a6b8763f59acba1f3 Mon Sep 17 00:00:00 2001 From: Abir Abbas Date: Thu, 20 Aug 2026 18:00:52 -0400 Subject: [PATCH] Make GH_TOKEN optional in the Go node manifest MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Every use of the token is lazy and degrades cleanly without it: github.NewClient falls back to unauthenticated API calls, clones only inject the token when set, and ProviderEnv forwards it only if present. Public repos review fine anonymously — the token is needed for private repos, posting reviews back to GitHub, and unthrottled rate limits. The e2e/functional harnesses already run with GH_TOKEN unset. Requiring it meant a fresh desktop install gated pr-af behind a "Needs keys" prompt for a credential many reviews never touch. Co-Authored-By: Claude Fable 5 --- go/agentfield-package.yaml | 9 +++++++-- go/cmd/pr-af/main.go | 4 +++- 2 files changed, 10 insertions(+), 3 deletions(-) diff --git a/go/agentfield-package.yaml b/go/agentfield-package.yaml index 5e2d7b3..8bd7cfa 100644 --- a/go/agentfield-package.yaml +++ b/go/agentfield-package.yaml @@ -28,11 +28,16 @@ user_environment: description: LLM provider key (OpenRouter) type: secret scope: global + optional: + # Optional, not required: every use is lazy and degrades cleanly without it + # (github.NewClient falls back to unauthenticated API calls, clones only + # inject the token when set) — public repos review fine anonymously. The + # token is needed for private repos, posting reviews back to GitHub, and + # unthrottled API rate limits. - name: GH_TOKEN - description: GitHub token (repo scope) + description: GitHub token (repo scope) — needed only for private repos and posting reviews type: secret scope: global - optional: - name: AGENTFIELD_SERVER description: Control-plane URL default: http://localhost:8080 diff --git a/go/cmd/pr-af/main.go b/go/cmd/pr-af/main.go index 2474060..b2905c1 100644 --- a/go/cmd/pr-af/main.go +++ b/go/cmd/pr-af/main.go @@ -18,7 +18,9 @@ // PR_AF_HARNESS_BIN optional executable override for every harness provider // OPENROUTER_API_KEY LLM key — required for the .ai() gates; AIConfig is only // attached when set (SDK rejects an empty key) -// GH_TOKEN GitHub token for FetchPR/clone/PostReview +// GH_TOKEN GitHub token for FetchPR/clone/PostReview (optional — +// public repos review anonymously; needed for private +// repos and posting reviews) // GITHUB_WEBHOOK_SECRET HMAC secret for /webhook/github (skip verify if unset) // PR_AF_BOT_MENTION webhook trigger mention (default @pr-af) package main